PT-2020-13289 · Ismartgate · Ismartgate Pro

Published 2020-09-24 · Updated 2020-09-27 · CVE-2020-12843

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ismartgate PRO version 1.5.9

Description The issue allows malicious file uploads through the form used for uploading sounds to garage doors, requiring the use of magic bytes for WAV files.

Recommendations For ismartgate PRO version 1.5.9, consider restricting access to the sound upload form until a fix is available, and ensure that all uploaded files are thoroughly validated to prevent malicious uploads.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-12843

Affected Products

Ismartgate Pro

References · 4

• 🔥 https://kth.diva-portal.org/smash/get/diva2:1464458/FULLTEXT01.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12843 · Security Note
• https://ismartgate.com/secure-garage-door · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12843 · Vendor Advisory